feat: add guarded release update check

Author: cbusillo

code-rs/Cargo.lock

@@ -48,6 +48,7 @@ which = { workspace = true }
 owo-colors = { workspace = true }
 serde_json = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
+sha2 = { workspace = true }
 supports-color = { workspace = true }
 tokio = { workspace = true, features = [
     "io-std",

code-rs/cli/Cargo.toml

@@ -17,7 +17,9 @@ use code_cli::login::run_login_with_device_code;
 use code_cli::login::run_logout;
 mod bridge;
 mod llm;
+mod update;
 use llm::{LlmCli, run_llm};
+use update::{UpdateCheckCommand, UpdateCommand, run_update, run_update_check};
 use code_common::CliConfigOverrides;
 use code_core::{entry_to_rollout_path, SessionCatalog, SessionQuery};
 use code_core::spawn::spawn_std_command_with_retry;
@@ -156,6 +158,13 @@ enum Subcommand {
     /// Download and run preview artifact by slug.
     Preview(PreviewArgs),
 
+    /// Check the GitHub Release update manifest for a newer build.
+    #[clap(name = "update-check")]
+    UpdateCheck(UpdateCheckCommand),
+
+    /// Update a directly managed dogfood binary after checksum verification.
+    Update(UpdateCommand),
+
     /// Side-channel LLM utilities (no TUI events).
     Llm(LlmCli),
 
@@ -619,6 +628,12 @@ async fn cli_main(code_linux_sandbox_exe: Option<PathBuf>) -> anyhow::Result<()>
         Some(Subcommand::Preview(args)) => {
             preview_main(args).await?;
         }
+        Some(Subcommand::UpdateCheck(args)) => {
+            run_update_check(args).await?;
+        }
+        Some(Subcommand::Update(args)) => {
+            run_update(args).await?;
+        }
         Some(Subcommand::Bridge(bridge_cli)) => {
             run_bridge_command(bridge_cli).await?;
         }