[Pepps233]

Summary

Startup and manual self-update still contacted Pi and treated an absent release like an outage.

Both now use https://api.diffex.ai/api/latest-version, validate the exact stable release response, and install only the locally pinned @diffexai/diffex@<version> target, including forced updates.

Reasoning

Version discovery must use the Diffex-owned authority and reject untrusted metadata before comparison or command construction.

All redirects are rejected before forwarding, and there is no fallback source or production endpoint override.

The shared HTTP contract has no note field, so unexpected remote notes are rejected while the intentional manual and interactive note-rendering code remains available for a coordinated contract extension.

Changes

• Use the shared contract validator and reject versions outside npm semver's supported numeric range.
• Distinguish exact no-release responses from service failures and invalid release metadata.
• Preserve silent automatic checks, offline mode, automatic-only opt-out, and bounded manual retries within one ten-second deadline.
• Extend controlled source-CLI and real-fetch redirect regressions, and document behavior and evidence in docs/release/self-update-target.md.

Testing

• Reproduced Pi requests, default redirect handling, and identical no-release/outage errors through the source CLI before implementation.
• Final focused checker and source-CLI suites: 101 passed, including 32 CLI cases with real-terminal startup and exit.
• Package-command integration and shared consumer fixture suites: 31 and 23 passed.
• npm run check passed.
• ./test.sh passed: 4,921 Vitest tests and 137 script tests; opt-in suites stayed disabled.
• Cloud-to-CLI contract document and fixture comparison passed; no old version endpoint remains in executable consumer paths.

Network responses and package-manager execution were intercepted in the CLI reproduction, and temporary resources were cleaned up.
The real Undici redirect tests used an isolated dispatcher with network access disabled and observed no requests to redirected hosts.
Live staging client canaries, production activation, and published-client acceptance remain separate validation work before release.
The stacked base does not trigger the repository's main-targeted CI workflow; the required local checks are recorded above.