# mehr update

Update mehr to the latest version from GitHub releases.

> **Note:** Self-update is CLI-only. Use this command to keep your CLI installation up to date.

## Synopsis

```bash
mehr update [flags]
```

## Description

The `update` command checks for new releases on GitHub and updates the installed binary:

- Without flags: installs latest stable release when newer than current
- With `--nightly`: installs the newest release across stable + pre-releases
- With `--version`: installs the exact release tag you requested

It supports:

- Automatic platform detection (linux/darwin, amd64/arm64)
- Minisign signature verification (if available)
- SHA256 checksum verification
- Nightly/pre-release version updates
- Atomic binary replacement (no downtime)

## How It Works

1. **Check** - Queries GitHub releases API for the latest version
2. **Download checksums** - Downloads `checksums.txt` and verifies its Minisign signature
3. **Download binary** - Downloads the platform-specific binary to a temporary file
4. **Verify checksum** - Verifies SHA256 checksum against signed checksums file
5. **Install** - Atomically replaces the current binary

### Security

The update process verifies release integrity using a chain of trust:

1. **Signature verification**: The `checksums.txt` file is signed with Minisign. If the signature is present and invalid, the update is aborted.
2. **Checksum verification**: The downloaded binary is verified against the SHA256 checksum in the signed checksums file.

If the signature file is missing (older releases), the update proceeds with a warning. If the signature is present but invalid, the update fails for security.

On Unix systems (Linux/macOS), the binary replacement is atomic using `os.Rename()`. The running process continues using the old binary, while new invocations use the updated version.

## Flags

| Flag            | Description                          | Default |
|-----------------|--------------------------------------|---------|
| `-n, --nightly` | Install latest stable/pre-release    | `false` |
| `-v, --version` | Install specific release tag         | `""`    |
| `--check`       | Check for updates without installing | `false` |
| `-y, --yes`     | Skip confirmation prompt             | `false` |

## Examples

### Update to Latest Stable

```bash
mehr update
```

Output:

```
→ Checking for updates...

✓ Update available
  Current:   v1.0.0
  Latest:    v1.1.0
  Release:   https://github.com/valksor/go-mehrhof/releases/tag/v1.1.0
  Download:  mehr-linux-amd64 (15.2 MB)

Download and install v1.1.0? [y/N]: y
⠋ Downloading and verifying update
✓ Download complete
✓ Signature verified
✓ Checksum verified
⠋ Installing update
✓ Installation complete

✓ Updated to v1.1.0
→ Restart mehr to use the new version
```

### Check Without Installing

```bash
mehr update --check
```

### Include Nightly Builds

```bash
mehr update --nightly
```

### Install Specific Version

```bash
mehr update --version v1.2.3
```

### Skip Confirmation

```bash
mehr update -y
```

## Automatic Update Checks

By default, mehr checks for updates on startup (once every 24 hours). If an update is available, you'll see a notification:

```
→ v1.1.0 is available (you have v1.0.0)
→ Run 'mehr update' to install
```

The automatic check:
- Runs in the background (doesn't slow startup)
- Times out after 5 seconds
- Only notifies, doesn't auto-install
- Is skipped for dev builds

### Disabling Automatic Checks

To disable automatic update checks, add to `.mehrhof/config.yaml`:

```yaml
update:
  enabled: false
```

### Adjusting Check Interval

To change how often checks occur (default: 24 hours):

```yaml
update:
  check_interval: 168  # Check every week instead
```

## Permissions

If Mehrhof is installed in a system directory like `/usr/local/bin`, you may need write permissions:

```bash
sudo mehr update
```

The command will detect if the directory is not writable and prompt you.

## Release Assets

The update command looks for binaries with these exact names:

```
mehr-linux-amd64
mehr-linux-arm64
mehr-darwin-amd64
mehr-darwin-arm64
checksums.txt           # SHA256 checksums
checksums.txt.minisig   # Minisign signature (optional, for verification)
```

## Authentication

GitHub token resolution (for higher rate limits):

1. `MEHR_GITHUB_TOKEN` environment variable
2. `GITHUB_TOKEN` environment variable
3. `gh auth token` (GitHub CLI)
4. Anonymous access (works for public repos, rate-limited)

## See Also

- [Quickstart](/quickstart.md) - Installing Mehrhof
- [Configuration](/configuration/index.md) - Configuring update behavior
- [CLI Overview](index.md) - All available commands
