(feat): adding update command

[lifeofpavs]

Summary

Adds jup update — a self-update command that fetches and runs install.sh from the matching release tag, which handles volta/npm/binary detection and installation internally.

Update command

• jup update — fetches install.sh from the release tag URL, writes it to a secure temp directory (mkdtemp), and executes it
• jup update --check — reports whether an update is available without installing
• Version detection via GitHub REST API (/repos/jup-ag/cli/releases/latest)
• Supports both JSON and table output formats

install.sh hardening

1. Secure temp file creation

The original script wrote to a predictable path (/tmp/jup), which is vulnerable to symlink attacks — an attacker could place a symlink at /tmp/jup pointing to another file, and the script would overwrite it. The fix uses mktemp -d for a unique temp directory and trap for cleanup:

TMP_DIR=$(mktemp -d)
TMP_BINARY="${TMP_DIR}/${BINARY}"
trap 'rm -rf "$TMP_DIR"' EXIT

2. Checksum grep error handling

Under set -e, if grep finds no matching checksum line it returns exit code 1, killing the script with no useful message. The fix suppresses the exit and provides an actionable error:

EXPECTED=$(grep "$ASSET" "$TMP_CHECKSUMS" | awk '{print $1}') || true
if [ -z "$EXPECTED" ]; then
  error "No checksum found for $ASSET in checksums.txt"
fi

In general, to fix insecure temporary file creation you should avoid constructing temp paths manually with os.tmpdir() and a static or predictable filename. Instead, use a library or API that creates the file atomically with secure permissions and a unique path, and then use that path. For Node.js, the tmp package is a well-known option that provides file() / fileSync() helpers that do this securely.

For this file, the best minimal fix is:

• Import the tmp library.
• In updateBinary, replace const scriptPath = join(tmpdir(), "jup-install.sh"); with creation of a secure temp file via tmp.
• Use the returned name (path) to write and execute the script.
• Keep the existing try/finally cleanup, but let tmp also track the file; rm remains harmless redundancy and preserves current behavior.

Concretely, in src/commands/UpdateCommand.ts:

1. Add import tmp from "tmp"; near the other imports.
2. Replace the scriptPath line with:

   const tmpFile = tmp.fileSync({ prefix: "jup-install-", postfix: ".sh" });
   const scriptPath = tmpFile.name;

   so we still have a scriptPath string as before, but now it is a securely created, unique file.

No other logic in updateBinary needs to change; writeFile, execSync, and the rm in the finally block can all continue to use scriptPath.

---

[lifeofpavs]

Addressed in a follow-up. The updater now creates a unique temp directory with mkdtemp(...), writes install.sh inside that directory with mode 0o700, and removes the directory in finally, so the predictable temp-file path is gone.